Unauthenticated Argo CD repo-server RCE exposes Kubernetes clusters to takeover

A high-severity flaw tracked as CVE-2026-15416 allows unauthenticated remote code execution in Argo CD by abusing the repo-server's GenerateManifest gRPC endpoint. According to Red Hat and related disclosures, an attacker with network access to the repo-server interface can exploit malicious KustomizeOptions, including BuildOptions or BinaryPath, to run arbitrary commands inside the repo-server pod. The issue is rated CVSS 8.9 and mapped to CWE-306 for missing authentication on a critical function.

The vulnerability can also be chained with access to the Argo CD Redis cache to tamper with cached data and push attacker-controlled Kubernetes manifests to Argo CD-managed environments, creating a path to full cluster compromise. Red Hat said affected products include Argo CD deployments and related OpenShift components, while OpenShift GitOps 1.20 and 1.21 are not affected because default Kubernetes NetworkPolicy settings block the required access to internal repo-server and Redis services. Recommended actions include patching to a fixed version, preventing external exposure of the repo-server, restricting network access to the gRPC endpoint and Redis, and reviewing deployment configurations.